Vendor
Combodo
88 known vulnerabilities.
Products
88 results · Feed
-
Medium 4.3
SQL query displayed on portal error
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, when a download error is triggered in the user portal, an SQL query is displayed to the user. This is fixed in versions 2.7.2 and 3.0.0.
-
Medium 6.8
Admin pages are cached and can be embedded
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after deconnection by using the browser back button. This is fixed in versions 2.7.2 and 3.0.0.
-
High 7.7
Information disclosure vulnerability in iTop
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access…
-
Medium 5.7
Combodo iTop - CSRF
Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery.
-
High 7.5
Combodo iTop - Security Misconfiguration
A security misconfiguration exists in Combodo iTop, which can expose sensitive information.
-
High 7.4
Combodo iTop - Reflected XSS
Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.
-
High 7.5
Combodo iTop - Broken Access Control
A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information.
-
Medium 6.8
Combodo iTop - Stored XSS
Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script.